DPDPA Section 28: Procedure to be Followed by the Data Protection Board

Most companies imagine regulatory enforcement as a dramatic physical event,suits walking into an office and unplugging servers. DPDPA Section 28 paints a very different, much more efficient picture.

It establishes the procedural spine for the Data Protection Board, designing it not as a dusty government bureaucracy, but as a digital-first tribunal. The Board doesn’t need to kick down your door to halt your operations; they can compel your data through a portal.

What Section 28 Establishes

The Board functions as an independent, digital-by-design office. When a complaint, reference, or direction lands under Section 27, the Board first decides if there are sufficient grounds to proceed. If not, the matter is closed with written reasons. If yes, an inquiry opens to assess compliance with the Act.

Crucially, the Board must follow the principles of natural justice. That means notice, a fair chance to respond, and reasoned actions. But do not mistake procedural fairness for weakness.

To discharge its functions, the Board wields powers similar to a civil court. They can summon individuals, examine them on oath, compel the discovery and production of documents, receive evidence by affidavit, and inspect data, books, and registers.

There is, however, a hard operational boundary. The Board and its officers cannot block access to your premises or take custody of your equipment if doing so would adversely affect day-to-day functioning. They can, however, requisition assistance from police or government officers, who are legally bound to comply.

During an inquiry, the Board can issue interim orders (after a hearing) to stop immediate risks. And if a complaint turns out to be false or frivolous? The Board can warn the complainant or impose costs.

Scope and Applicability

Section 28 governs the entire lifecycle of a proceeding,from intake and screening to inquiry, interim measures, and final closure.

The “digital office” mandate cuts both ways. Organizations must be prepared for digital notices, digital filings, and digital hearings. You cannot rely on paperwork getting lost in the mail. Rules will eventually flesh out the exact operational details of this digital functioning, but the expectation of rapid, electronic compliance is already set.

How the Process Typically Unfolds

• Intake and screening: The Board reviews a complaint or reference. Insufficient grounds mean immediate closure with written reasons.
• Opening an inquiry: If grounds exist, the Board investigates the affairs of any person to test compliance, recording reasons at every step.
• Evidence and inspection: The Board exercises its civil court powers,summoning staff, demanding affidavits, and inspecting records.
• Operational safeguards: The Board cannot seize equipment in a way that halts your daily operations.
• Authority support: Police and government officers can be called in to assist the Board.
• Interim control: The Board can issue binding interim orders after a hearing.
• Closure or escalation: Post-inquiry, the matter ends in either closure or an escalation to Section 33 for penalties.
• Frivolous claims: False complaints can trigger warnings or financial costs for the complainant at any stage.

Practical Meaning for Organizations

Expect a digital process from end to end. Your legal and operations teams must be ready to respond through the Board’s digital systems, which means maintaining a monitored contact channel is no longer optional.

Use the screening stage to your advantage. A clear, well-supported early response can prove there is no case to answer before an inquiry even fully opens. Because natural justice is built into the process, you have the right to be heard before interim or final orders. Use that window to present facts, context, and corrective actions.

Prepare for civil court-style demands. You may need to produce documents on short notice, submit affidavits, and make personnel available for examination under oath. Your records must be accurate, accessible, and defensible.

Finally, know the limits of the Board’s physical reach. They cannot take custody of equipment or disrupt day-to-day functioning. If an inspection threatens to take your systems offline, you have the right to insist on measures that preserve operations while enabling the inspection.

Interim Orders and Outcomes

Interim orders are not suggestions. They are binding, time-sensitive directives issued during an inquiry to address immediate risks. While they require an opportunity to be heard and written reasons, expect them to be highly targeted.

Once the inquiry concludes, the Board either closes the matter or escalates it under Section 33,where directions or financial penalties are decided. The quality of your submissions and cooperation during the inquiry directly shapes that final outcome.

Handling a Notice from the Board

Figuring out how to respond to the Data Protection Board shouldn’t happen on the fly. When a notice arrives, follow a strict playbook:

• Verify authenticity through the Board’s official digital channels.
• Acknowledge receipt and lock in a response timeline.
• Issue a legal hold to preserve all relevant records and logs.
• Map the issues to specific processing activities, systems, and vendors.
• Compile the evidence. Gather policies, consent records, notices, processing registers, DPIAs (if any), contracts, and incident logs.
• Appoint a single point of contact to coordinate counsel, security, and operations.
• Prepare a factual chronology backed entirely by evidence, not assumptions.
• Propose pragmatic interim mitigations if a real risk exists, reducing the likelihood of heavy-handed interim orders.
• Call out frivolous claims. If the complaint is plainly false, document the proof and request closure with costs.

What Complainants Should Know

The Board is not a suggestion box. Complaints are handled digitally and must be specific regarding facts, dates, and impact. Because the Board can impose costs for false or frivolous complaints, claims must be focused, substantiated, and backed by relevant documents.

Interpretation Boundaries

Section 28 dictates process, not policy. It does not list substantive privacy obligations or specific penalty amounts. It simply connects the triggers in Section 27 to the enforcement actions in Section 33.

The Board’s civil court powers are strictly limited to specific matters like summons, affidavits, discovery, and inspection. The section explicitly preserves operational continuity by restricting the custody of equipment. Where rules are referenced, do not assume the Board’s scope extends beyond the plain text of the Act until those rules are officially notified.

What Changes in Practice

• Digital-first engagement: Keep filings, evidence, and responses structured and portal-ready.
• Evidence discipline: Maintain audit trails, access logs, and document retention aligned to your data lifecycle.
• Witness readiness: Train key staff on giving statements and handling examinations on oath.
• Playbooks for inquiries: Define roles, timelines, evidence packs, and decision paths for interim remedies before a notice arrives.
• Governance of reasons: The Board is legally required to record its reasons. Mirror that discipline in your own submissions.

A well-prepared operator treats a Board inquiry like a litigated audit. Facts clean, timelines tight, responses timely.

But real execution is where compliance breaks. Teams are forced to juggle production systems, vendors, and live incidents while legal clocks tick. At Regodit, we built a structured way to manage obligations, evidence, and responses,so when the Board’s digital notice arrives, your position is clear, defensible, and ready to submit.